Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

13 records

Vendor: Smartypants Component: Sp Project & Document Manager Clear all filters
TI-2024-03495 CVE-2024-3749 · GHSA-qfmw-8q7m-gxm5

SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR

Priority MEDIUM 64

The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00523 Published 2024-05-15 No fix listed
TI-2024-03494 CVE-2024-3748 · GHSA-qvgf-wgjr-g932

SP Project & Document Manager <= 4.71 - Data Update via IDOR

Priority HIGH 68

The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the `user_id` to make it appear that a file was uploaded by another user

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00434 Published 2024-05-15 No fix listed
TI-2024-16382 CVE-2024-24868 · GHSA-2q38-w8jv-6jxm

WordPress SP Project & Document Manager Plugin <= 4.69 is vulnerable to SQL Injection

Priority LOW 39

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.69.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00544 Published 2024-02-28 No fix listed CWE-89
TI-2023-18492 CVE-2023-36677 · GHSA-82h7-5mqq-xr6g

WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to SQL Injection

Priority MEDIUM 41

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager allows SQL Injection.This issue affects SP Project & Document Manager: from…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00727 Published 2023-11-03 No fix listed CWE-89
TI-2023-02869 CVE-2023-3063 · GHSA-q7v4-x6v3-759c

Authorization bypass in Smartypants SP Project & Document Manager

Priority MEDIUM 41

The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.67.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00729 Published 2023-06-30 No fix listed CWE-639
TI-2022-01422 CVE-2022-1551 · GHSA-qwqq-2qch-x65x

SP Project & Document Manager < 4.58 - Sensitive File Disclosure

Priority LOW 31

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00983 Published 2022-07-25 Fixed in 4.58 CWE-425
TI-2021-03086 CVE-2021-4225 · GHSA-cg4w-83q5-49gw

SP Project & Document Manager < 4.24 - Subscriber+ Shell Upload

Priority MEDIUM 41

The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01716 Published 2022-04-25 Fixed in 4.24 CWE-434
TI-2021-15922 CVE-2021-38315 · GHSA-pp76-wh65-xhx2

SP Project & Document Manager <= 4.25 Reflected Cross-Site Scripting

Priority LOW 29

The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00938 Published 2021-08-16 No fix listed CWE-79
TI-2021-06639 CVE-2021-24347 · GHSA-p8xc-86cg-8cgm

SP Project & Document Manager <2 4.22 - Authenticated Shell Upload

Priority HIGH 70

The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.5408 Published 2021-06-14 Fixed in 4.22 CWE-178
TI-2014-07446 CVE-2014-9178 · GHSA-r4rm-j888-6w3w

Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP…

Priority MEDIUM 40

Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute a…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04632 Published 2014-12-02 No fix listed CWE-89